PENNSYLVANIA HEALTH INSURANCE EXCHANGE AUTHORITY NON-EXCHANGE ENTITY AGREEMENT THIS NON-EXCHANGE ENTITY AGREEMENT (hereinafter “Agreement”) is entered into between the Pennsylvania Health Insurance Exchange Authority d/b/a Pennie (hereinafter “PHIEA”), a state-affiliated entity established within the Commonwealth of Pennsylvania pursuant to Act 42 of 2019, 40 Pa.C.S. §§ 9301-9314, and the producer, assister, certified application counselor, individual, entity, or other approved person accessing the Exchange Platform and whose name appears in PHIEA’s registration system (hereinafter “Enrollment Assister”). PHIEA is authorized under the Patient Protection and Affordable Care Act (Public Law 111-148), as amended by the Health Care and Education Reconciliation Act of 2010 (Public Law 111-152) (collectively known as “the Affordable Care Act” or “ACA”), and Act 42 of 2019, 40 Pa.C.S. §§ 9301-9314, to establish or operate in this Commonwealth a technical platform that facilitates or assists in facilitating enrollment of eligible individuals in Qualified Health Plans and Qualified Dental Plans. In furtherance of its established purpose of benefiting the Pennsylvania health insurance market and those persons enrolling in health insurance policies, PHIEA must provide third party access to the Exchange Platform to assist customers. These Enrollment Assisters will assist qualified individuals to enroll in Qualified Health Plans and Qualified Dental Plans, applying for Advanced Premium Tax Credits, and Cost Sharing Reductions as applicable, to the extent that the Enrollment Assisters are permitted to do so by Federal and State Law. The contractual relationship between PHIEA and the Enrollment Assister set forth in this Agreement is expected to involve the transmission of Personally Identifiable Information (“PII”) as that term is defined herein, for purposes authorized under the ACA, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and other applicable Federal and State Laws including, but not limited to, assisting customers with the application process for Qualified Health Plans and Qualified Dental Plans and determining eligibility for insurance affordability programs. The Enrollment Assister’s access to PII submitted to PHIEA shall make the Enrollment Assister and/or the Entity a “Non-Exchange Entity” (as defined in Article 1). 45 CFR § 155.220(d) requires all persons enrolling qualified individuals in Qualified Health Plans and Qualified Dental Plans in a manner that constitutes enrollment through the Exchange Platform, or assisting qualified individuals in applying for insurance affordability programs, to comply with the terms of an agreement between the Enrollment Assister/Non-Exchange Entity and PHIEA. As such, PHIEA requires the acknowledgement, affirmation, and acceptance of this Agreement as a condition precedent to the Enrollment Assister’s application to become an Enrollment Assister with access to the Exchange Platform. PHIEA and the Enrollment Assister each acknowledge and agree that they enter into this Agreement for the purposes, among others as may be detailed herein, of ensuring the confidentiality, privacy and security of data accessed by the Enrollment Assister or exchanged FORM APPROVED:130-FA-2.0 (September 3, 2020) between the parties under this Agreement, compliance with the requirements of the ACA, including 45 C.F.R. § 155.260(b)(2), and other applicable Federal and State Laws, regardless of whether otherwise applicable to the Enrollment Assister. Article 1 – General Contract Terms 1.1 Definitions. a. Advance Premium Tax Credit (“APTC”) means advanced payments of the premium tax credit authorized by 26 U.S.C. § 36B and otherwise defined as advanced payment of the premium tax credits in 45 C.F.R. § 155.20. b. Applicant has the same meaning as in 45 C.F.R. § 155.20. c. Breach has the same meaning as in OMB Memorandum M-17-12 (January 3, 2017), and means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII, or (2) an authorized user accesses or potentially accesses PII for an other-than-authorized purpose. For purposes of this definition, unless otherwise inconsistent with OBM Memorandum M-17-12, a Breach shall also constitute a breach in accordance with the applicable provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), including the Administrative Simplification Provisions of HIPAA, as codified at 42 U.S.C. § 1320d et seq., and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”). d. Cost-Sharing Reductions (“CSRs”) has the same meaning as in 45 C.F.R. § 155.20. e. Customer has the same meaning as Enrollee as defined in 45 C.F.R. § 155.20 who is enrolled in a Qualified Health Plan or Qualified Dental Plan offered through the Exchange Platform. f. Enrollment Assister means a producer, navigator, in-person assister, certified application counselor, other similar Non-Exchange Entities and their employees, or individuals or groups of individuals, certified by PHIEA, who may facilitate enrollment in Qualified Health Plans or Qualified Dental Plans offered through the Exchange Platform or perform similar consumer or small business assistance functions. g. Entity means any person, whether an individual or legal organization, whose business is directly related to enrollment through the Exchange Platform, or to assist Qualified Individuals in applying for APTC and/or CSRs, and in applying for and enrolling in Qualified Health Plans or Qualified Dental Plans in a manner that is considered to be through the Exchange Platform. 2 FORM APPROVED:130-FA-2.0 (September 3, 2020) h. Exchange or Exchange Authority means a health insurance exchange as contemplated by the ACA, established or operating in this Commonwealth, that facilitates or assists in facilitating enrollment in QHPs and QDPs. This definition includes the Pennsylvania Health Insurance Exchange Authority (PHIEA), which was created pursuant to Act 42 of 2019, 40 Pa.C.S. §§ 9301-9314, doing business as “Pennie,” and facilitates the sale of Qualified Health Plans and Qualified Dental Plans on the Exchange Platform. i. Exchange Platform means the technical platform which PHIEA makes available to health insurers to sell Qualified Health Plans and Qualified Dental Plans to Customers. j. Federal and State Law(s) means any and all applicable federal and state laws, rules, regulations, or guidance documents, as amended during the course of this Agreement, whether applicable singularly or in concert, that are not otherwise specified by name or legal citation, including, but not limited to Act 42 of 2019, 40 Pa.C.S. §§ 9301-9314; the Patient Protection and Affordable Care Act (Public Law 111-148), as amended by the Health Care and Education Reconciliation Act of 2010 (Public Law 111-152) and the regulations promulgated thereunder; the Health Insurance Portability and Accountability Act of 1996 (HIPAA, including the Administrative Simplification Provisions of HIPAA, as codified at 42 U.S.C. § 1320d et seq.), and the regulations promulgated thereunder, and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”). k. Health Insurance Portability and Accountability Act (“HIPAA”) means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as amended, and its implementing regulations. l. Incident, or Security Incident, has the same meaning as in OMB Memoranda M- 17-12 (January 3, 2017) and means an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. For purposes of this definition, an incident or security incident, where not inconsistent with OMB Memorandum M-17-12, shall also constitute an incident or security incident under the applicable provisions of HIPAA, including the Administrative Simplification Provisions of HIPAA, as codified at 42 U.S.C. § 1320d et seq., and HITECH. m. Non-Exchange Entity has the meaning set forth in 45 C.F.R. § 155.260(b)(1). n. Patient Protection and Affordable Care Act (“Affordable Care Act” or “ACA”) means the Patient Protection and Affordable Care Act (Public Law 111-148), as amended by the Health Care and Education Reconciliation Act of 2010 (Public Law 111-152), which are referred to collectively as the Affordable Care Act or the ACA. 3 FORM APPROVED:130-FA-2.0 (September 3, 2020) o. Pennie means the Pennsylvania Health Insurance Exchange Authority and its Exchange Platform. p. Personally Identifiable Information (PII) has the same meaning as in OMB Memorandum M-17-12 (January 3, 2017), and refers to any information that identifies or describes an individual, including, but not limited to, his or her name, social security number, physical description, home address, home telephone number, education, financial matters, medical or employment history, and statements made by, or attributed to, the individual. It also includes any identifiable information collected from or about an individual for purposes of determining eligibility for enrollment in a Qualified Health Plan or Qualified Dental Plan, determining eligibility for other insurance affordability programs, determining eligibility for